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We study the equivalence between a realistic quantum key distribution protocol using coher- 
ent states and homodyne detection and a formal entanglement purification protocol. Maximally- 
entangled qubit pairs that one can extract in the formal protocol correspond to secret key bits in 
the realistic protocol. More specifically, we define a qubit encoding scheme that allows the formal 
protocol to produce more than one entangled qubit pair per coherent state, or equivalently for the 
realistic protocol, more than one secret key bit. The entanglement parameters are estimated us- 
ing quantum tomography. We analyze the properties of the encoding scheme and investigate its 
application to the important case of the attenuation channel. 



I. INTRODUCTION 

Quantum key distribution (QKD), also called quan- 
tum cryptography, allows two parties, Alice and Bob, to 
share a secret key that can be used for encrypting mes- 
sages using a classical cipher, e.g., the one-time pad. The 
main interest of such a key distribution scheme is that 
any eavesdropping is, in principle, detectable as the laws 
of quantum mechanics imply that measuring a quantum 
state generally disturbs it. 

The resources required by QKD comprise a source of 
non-orthogonal quantum states on Alice's side, a quan- 
tum channel conveying these states to Bob, a measuring 
apparatus on Bob's side, and a (public) authenticated 
classical channel between Alice and Bob. In addition to 
being used to generate a secret key, the quantum channel 
is subject to probing by the legitimate parties, so as to 
determine how many secret bits can be generated. 

Most interest in QKD has been devoted to protocols in- 
volving (an approximation to) a single-photon source on 
Alice's side and a single-photon detector on Bob's side 
(see [l| and the references therein). However, protocols 
involving quantum continuous variables have been con- 
sidered with an increasing interest 0&EJ1- Of special 
importance are coherent-state protocols [(jlI- The quan- 
tum source at Alice's side randomly generates coherent 
states of a light mode with Gaussian-distributed quadra- 
tures, and Bob's measurements are homodyne measure- 
ments. These protocols seem to allow for facilitated 
implementations and higher secret-key generation rates 
than the protocols involving single-photon sources 0. 

Consequently, there is an increasing interest for study- 
ing the security of coherent state protocols under general 
classes of attacks. Individual Gaussian attacks are con- 
sidered in H Q , and are found to be optimal in the more 
general class of finite- width non-Gaussian incoherent at- 
tacks Individually-probed collective attacks are also 
considered in H[T3. The recent techniques of [HQ2 do 
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not make any assumptions on the eavesdropper's technol- 
ogy and are also considered in H for coherent state 
protocols, although giving lower secret key rates. 

In this paper, we study the security of a prepare- 
and-measure QKD protocol 0] by establishing its 
equivalence to an entanglement purification (EP) pro- 
tocol, which produces maximally- entangled qubit pairs. 
A maximally-entangled qubit pair is by definition com- 
pletely factored from its environment, and thus the val- 
ues obtained by measuring each side are fully correlated 
and secret. The equivalent prepare-and-measure QKD 
protocol also enjoys this property. This particular tech- 
nique thus allows one to relieve from any assumptions 
on the eavesdropper's strategy and was used in |13| to 
assess the security of the BB84 protocol and in Q for 
a squeezed state protocol. More recently, this technique 
was extended to the case of coherent state protocols [TJJ . 

To show the equivalence between a QKD protocol and 
of an EP protocol, one has to explicitly take into account 
the secret key distillation, that is, the techniques used to 
make Alice's and Bob's keys equal (reconciliation) and 
fully secret (privacy amplification). In the EP pro- 
tocol uses CSS quantum codes which are equiv- 
alent in QKD to reconciliation with syndromes of binary 
linear codes and privacy amplification by multiplication 
with a parity-check matrix. In contrast to BB84, the 
modulation of coherent states in the protocol we con- 
sider here is continuous, therefore producing continuous 
key elements from which to extract a secret key. Rec- 
onciliation of a Gaussian-distributed key was studied in 
|17| . and a generic protocol called sliced error correction 
was designed so as to distill a binary key. 

In contrast to 14], the EP protocol is constructed in 
such a way that it is equivalent to a QKD protocol with 
sliced error correction for reconciliation. The advantage 
is the higher secret key rate and the better resistance 
to attenuation that one can achieve. In particular, more 
than one maximally- entangled pair (or secret key bit) can 
be produced per coherent state. Furthermore, thanks to 
its generality, the asymptotic efficiency of the EP proto- 
col inherits to some extent from the asymptotic efficiency 
of the classical reconciliation protocol. 
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The paper is organized as follows. First, in Sec. [D] we 
macroscopically describe the formal EP protocol and its 
equivalent QKD protocol that are used throughout the 
paper. Then, in Sec. IIIII we show how the channel can be 
probed so as to determine the number of secret key bits 
that Alice and Bob can generate. The encoding of qubits, 
that is, the generalization of sliced error correction to 
EP, is described in Sec. IIVI Then, Sec. deals with 
the important particular case of an attenuation channel. 
Finally, the asymptotic properties of the qubit encoding 
scheme are detailed in Sec. IVII 

II. FROM ENTANGLEMENT PURIFICATION 
TO SECRET KEY DISTILLATION 

After we review the case of EP using CSS codes and its 
equivalence to BB84, we give a high-level description of 
a QKD protocol based on EP. We consider this protocol 
as formal, that is, we do not expect a physical implemen- 
tation of it. Instead, we propose a prepare- and- measure 
QKD protocol, derived from the formal one, which also 
encompasses error correction and privacy amplification. 

A. Binary CSS codes 

In the case of BB84, the CSS codes can readily be used 
to establish the equivalence between an EP protocol and 
a QKD protocol [13. Since we will use CSS codes as an 
ingredient for the EP and QKD protocols below, let us 
briefly review their properties. 

Starting from the Einstein-Podolski-Rosen (EPR) 
state 

|0+)=2- 1 / 2 (|OO) + |ll)), (1) 

Alice keeps half of the state and sends the other half to 
Bob. His part may undergo a bit error (|0 + ) — ► |V' + ))> 
phase error (|0 + ) — * \(f>~)) or both errors (|</> + ) — + 
with \(t>~) = 2- 1 /2(|()0) - |H)) and |^±) = 2- 1 / 2 (|01) ± 
1 10)). Given that not too many such errors occurs, Alice 
and Bob can obtain, from many instances of such a trans- 
mitted state, a smaller number of EPR pairs using only 
local operations and classical communications (LOCC). 
One way to do this is to use CSS codes. 

Let C\ and Ci be two binary error correcting codes 
of n bits (i.e., C\ and C2 are vector spaces of F§) with 
parity check matrices H\ and H2, resp. They are cho- 
sen such that {0} c C* 2 C Ci c F£. A CSS code is 
a fc-dimensional subspace of Tt n , the Hilbert space of n 
qubits, with k = dimCi - dimC 2 HHH. The code C l 
allows to correct bit errors, while C^ - (the dual code of 
C2) allows to correct phase errors — one important prop- 
erty of the CSS codes is to be able to correct bit errors 
and phase errors independently. 

For entanglement purification, Alice and Bob must 
compare their syndromes, both for bit errors and phase 
errors. The relative syndrome determines the correction 



that Bob must apply to align his qubits to Alice's. Trans- 
lating this into the BB84 protocol, one can show [13] that 
the relative syndrome for bit errors in the EP protocol is 
equal to the relative syndrome for bit errors that Alice 
and Bob would have reconciled in the BB84 protocol. So, 
reconciliation can be done using the C\ code. Phase er- 
rors of the EP protocol do not have such a direct equiv- 
alent in the BB84 protocol: The prepare-and-measure 
protocol works as if Alice measured her part of the state 
in the {|0), |1)} basis, thereby discarding information on 
the phase. However, one does not really need to correct 
the phase errors in the BB84 protocol. Instead, if C2 
would be able to correct them in the EP protocol, the 
syndrome of C2 in C\ of Alice and Bob's bit string turns 
out to be a valid secret key in the prepare-and-measure 
protocol. Stated otherwise, Hi determines the syndrome 
Alice has to send to Bob to perform reconciliation, while 
H2 determines the way the final key is computed for pri- 
vacy amplification. 

Overall, the number of secret key bits is thus k = 
dimCi — dimC2, provided that G\ (resp. C^) is small 
enough to correct all the bit (resp. phase) errors. When 
considering asymptotically large block sizes, the CSS 
codes can produce 

Jfe = rn -> n(l - h(e h ) - h(e p )) = Rn (2) 

EPR pairs or secret key bits, with e b (resp. e p ) the 
bit (resp. phase) error rate and h(p) = —p\og 2 p — (1 — 

p)io g3 (i-p) m. 

We conclude this section by noting that the bit error 
rate e b determines the number of bits revealed by recon- 
ciliation (asymptotically h(e h )), whereas the phase error 
rate e p determines the number of bits discarded by pri- 
vacy amplification due to eavesdropping (asymptotically 
h(e?)). 

B. Quantum key distribution based on 
entanglement purification 

In BB84, the modulation of qubits can be transposed 
as if Alice prepares a \4> + ) state and measures her part. In 
the case of the QKD protocol with Gaussian-modulated 
coherent states, the formal state that Alice prepares is of 
course different, as it must reduce to the proper modula- 
tion when Alice measures her part. We define the formal 
state as: 



I*) = / dxdpg{x lP )\x) ai ® \p) aa ® \x + ip) b , (3) 

where g(x,p) denotes a bi-variate Gaussian distribution 
g{x,p) = y/G 1 (x)G 2 (p)- The kcts \x), \p), \x + ip) 
are shorthand notations for respectively a x-quadrature 
eigenstate with eigenvalue p-quadrature eigenstate 
with eigenvalue p and a coherent state whose x mean 
value equals x and whose p mean value equals p. The 
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subscripts ai, a2 (resp. b) denote that the system is lying 
on Alice's side (resp. Bob's side). 

The state (0 does not have a direct physical meaning. 
In particular, the systems ai and a2 must be understood 
as classical pointers, e.g., resulting from the (formal) ho- 
modyne measurement of an EPR state as studied in . 

In the entanglement purification picture, the b part of 
the system is sent to Bob (and possibly attacked by Eve) 
and the a part stays at Alice's station. If Alice measures 
x in ai and p in a2, the state is projected as if Alice sent 
Bob a coherent state centered on x + ip. 

Let us now describe the EP protocol, which reduces 
to the prepare-and-measure QKD protocol described fur- 
ther. 

• Alice creates I + n copies of the state of which 
she sends the b part to Bob. 

• Bob acknowledges reception of the states. 

• Out of the I + n states, n will serve for estimation 
purposes. These states are chosen randomly and 
uniformly by Alice, who informs Bob about their 
positions. 

• For the remaining I states, Alice and Bob perform 
entanglement purification, so as to produce rl (0 < 
r < 1) states very close to \4> + ). Measured in the 
computational bases, the produced states yield rl 
secret bits on both Alice's and Bob's sides. 

The details of the EP procedure, which uses CSS codes as 
an ingredient, are given in Sec. II VI while the estimation 
is detailed in Sec. 11111 



C. Prepare-and-measure quantum key distribution 

By virtually measuring the a part of the state 1 9) , the 
protocol above reduces to the following one. 

• Alice modulates I + n coherent states \x + ip) that 
she sends to Bob. The choice of the values of x and 
p follow the distribution \g(x,p)\ 2 — G\{x)G2{p)- 

• Bob acknowledges reception of the states. 

• Out of the I + n states, n will serve for estimation 
purposes. These states are chosen randomly and 
uniformly by Alice, who informs Bob about their 
positions. 

• For the remaining I states, Bob measures x. Alice 
and Bob perform secret key distillation (reconcili- 
ation and privacy amplification), so as to produce 
rl secret bits. 

The reconciliation and privacy amplification procedures 
are based on classical error correcting codes, which derive 
from the CSS codes used in the formal EP protocol. 



III. ERROR RATES ESTIMATION USING 
TOMOGRAPHY 

In QKD protocols derived from EP, an important step 
is to show how one can infer the bit and phase error rates 
of the samples that compose the key. A fraction of the 
samples sent by Alice to Bob are sacrificed so as to serve 
as test samples. By randomly choosing them within the 
stream of data, they are statistically representative of the 
whole stream. 

In |3, Il3| , one can simply make measurements and di- 
rectly count the number of bit and phase errors from the 
results. This is possible since Bob's apparatus can mea- 
sure both bit and phase values. In |14| . however, it is not 
possible to measure directly phase errors. Yet some data 
post-processing can be applied on measurements so as to 
infer the number of phase errors in the stream of data. In 
this section, we wish to show that we can extend this to 
more general (and more efficient) encodings of qubits (in 
the EP picture) or bits (in the derived QKD protocol). 

The encoding of bits will be described in a further 
section — for the moment, the qubit pair system (i.e., one 
among possibly several ones), which Alice and Bob will 
process using CSS codes, is abstractly represented by its 
Pauli operators acting in ai: Z s (phase flip) and X 5 (bit 
flip), and in b: Z e and X e . (The subscripts s and e stand 
for slice and estimator, resp., to follow the convention of 
the following sections.) The bit errors are assumed to 
be easy to determine, that is, Z 5 has a diagonal expan- 
sion in \x) 3 {x\, and Z e can directly be determined by 
a single homodyne measurement on b. This ensures, in 
the derived prepare-and-measure QKD protocol, that Al- 
ice knows the bit value she sent, and Bob can determine 
the received bit value. A measurement of the observable 
X s I a2 X e associated to the phase error rate, however, can- 
not be implemented by a single homodyne measurement 
on b. Therefore, we have to invoke quantum tomography 
with a quorum of operators [l^ to get an estimate of the 
phase error rate. 



A. Estimating phase errors in the average state 

In the EP picture, let be the state of the n sam- 
ples used for estimation of the phase error rate (i.e., n 
instances of the a^b system). To count the number of 
phase errors in a set of n samples, one needs to measure 
O = X s I a2 X e on the n samples and sum the results (with 
I a2 the identity in the system a2). This is equivalent to 
measuring OW = Ei^b ® X 5 I a2 X e ® T%£. If the 
true phase error probability in the n + I samples is e p , 
the error variance is a\ — 2e p (l — e p )/n, and thus the 
probabi lity of making an estimation error of more than 
A is HE3I asymptotically exp(-A 2 n/4e p (l - e p )). It is 
easy to see that 

Tr(0 (n y n) ) = nTr(Op), (4) 
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where p = H^V^TrAmmOo^) is the density matrix 
of the average state measured. So, we can estimate the 
number of phase errors using the average state, even if 
eavesdropping is joint (p® n ^ p( n > ) . 

If the measurement of O = X 5 I a2 X e cannot be made 
directly, one instead looks for a quorum of operators Qa 
such that O = J dAo(A)QA; estimating (O) comes down 
to measuring several times Qa for values of A chosen 
randomly and independently of each other, and av erag ing 
the results weighted by o(A): O ps XX A *)Qa; If 
the values of A are chosen independently of the sample 
index on which Qa is applied, we get unbiased results, 
as Tr(Op) = E x [Tr(Q x p)}, with E the expectation. Of 
course, the estimation of Tr(Op) with a quorum cannot 
be perfect and an estimation variance a\ must also be 
considered and added, a 2 — a\ + of. 



B. Estimating phase errors using coherent states 
and homodyne detection 

We now explain how the phase error rate can be esti- 
mated, in principle, using coherent states modulated in 
both quadratures and homodyne detection in all quadra- 
tures. 

It is clear that the knowledge of matrix elements of 
the average state p gives the knowledge of (O). Let po = 
\^) be the state that Alice and Bob would share if the 
transmission was perfect. Since the a part of the system 
stays at Alice's station, we only need to learn about how 
the b part of the system is affected. In the prepare-and- 
measure picture, let T be the completely positive (CP) 
map that maps the states sent by Alice onto the states 
received by Bob, (Id<g>T)(po) = P- In particular, let the 
coherent state \x + ip)(x + ip\ be mapped onto px(x + ip) 
and the (pseudo-)position state |x)(x'| be mapped onto 
px(x,x'). The functions pr{x + ip) and pr(x,x') are 
related by the following identity: 

PT (x + tp) <x J dx'dx"e-V-^/ 4N °-( x "-^/ 4N ° 

e i{ - x '- x "W 2No p T {x',x"), (5) 

with Nq the variance of the vacuum fluctuations. By 
setting D — x' — x" and S — x' + x" — 2x, we get: 

PT (x + ip) cx J &D&Se- s2 /* N «- D2 l m « +lD Pl 2N « 

p T (x + S + D,x + S-D), (6) 

which shows that Pt(x,x') is integrated with an invert- 
ible kernel (Gaussian convolution in S, multiplication by 
e -D /SN ^ an( j p our j er transform in D). So in principle, 
any different CP map T' ^ T implies a different effect on 
coherent states, pr(x + ip) ^ pt>(x + ip). The modula- 
tion of coherent states in both quadratures is thus crucial 
for this implication being possible. 



By inspecting Eq. © , it seems that due to the factors 
e -S 2 /8JV and e -n 2 /8JV 0j tw0 different CP-maps T and T' 
may make pr{x + ip) and pt'{x + ip) only vanishingly 
different. It thus seems unlikely that Eq. JBJ) should allow 
us to extract the coefficients pr{x + S + D,x + S — D). 
However, assuming that T depends only on a finite num- 
ber of parameters, a variation of these parameters will 
induce a measurable variation of pT(x + ip). We will now 
discuss why it is reasonable to make such an assumption. 

Due to the finite variance of the modulation of coherent 
states, the probability of emission of a large number of 
photons vanishes — this intuitively indicates that we only 
need to consider the description of T for a bounded num- 
ber of emitted photons. More precisely, one can consider 
the emission of w joint copies of the state pob = Tr a (po)- 
For w sufficiently large pf™ can be represented in the 
typical subspace Ts(pob) of dimension not greater than 
2 «'(ff(Pob)+<5) ; f or any § > o 20], where H(p) is the Von 
Neumann entropy of a state p. The probability mass of 
Pob" ou fside the typical subspace can be made arbitrarily 
small and does not depend on the eavesdropping strat- 
egy. This means that the support for the input of T has 
finite dimension, up to an arbitrarily small deviation. 

The number of photons received by Bob can also be 
upper bounded. Alice and Bob can first assume that 
no more than n max photons are received. This fact may 
depend on a malicious eavesdropper, so Bob has to do 
hypothesis testing. The test comes down to estimating 
(II) with II = J2n>n m J n )( n \- If the threshold is well 
chosen so that n > n max never occurs, we can apply the 
central limit theorem and upper bound the probability 
that (II) > e for any chosen e > 0. The positivity of the 
density matrices implies that the off-diagonal coefficients 
are also bounded. We can thus now express pr(x + ip) as 
p T (x + ip) = E„,„'<„ max PT(x + ip,n,n')\n)(n'\. Note 
that the test can be implemented either by explicitly 
measuring the intensity of the beam (therefore requiring 
an additional photodetector) or by exploiting the correla- 
tion between the high intensity of the beam and the high 
absolute values obtained when doing homodyne measure- 
ments in all directions. 

Finally, the estimation of the coefficient of |n)(n'| 
can be done with arbitrarily small statistical error us- 
ing homodyne detection in all directions [T^ . l2l| . This 
is achieved by considering the quorum of operators 
(xg) 0<e<2Tr , where xg = cos 9 x + sin 9 p denotes the am- 
plitude of the quadrature in direction 9. Considering a 
finite combination of arbitrarily small statistical errors on 
parameters also gives arbitrarily small overall statistical 
error on the phase error rate. 



IV. ENCODING OF MULTIPLE QUBITS IN AN 
OSCILLATOR 

Reconciliation and privacy amplification are integral 
parts of the prepare-and-measure protocols derived from 
entanglement purification protocols. In our case, we wish 
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to derive a prepare-and-measure protocol with sliced er- 
ror correction (SEC) 01 as reconciliation, which allows 
us to obtain a higher secret key rate and a better resis- 
tance to losses than in [l4| . We therefore need to describe 
an entanglement purification procedure that reduces to 
SEC when the corresponding prepare-and-measure pro- 
tocol is derived. An overview of SEC is proposed next. 



A. Sliced error correction with invertible mappings 

We here recall the main principles of SEC in a form 
that is slightly different from the presentation in [TtJ . To 
suit our needs, we here describe SEC in terms of invert- 
ible functions giving the slices and the estimators — the 
invertibility property will be required when we generalize 
SEC to entanglement purification. Also, from the gener- 
ality of two parameters are fixed here: Binary error 
correction is operated by sending syndromes of classical 
linear error-correcting codes (ECC), and we momentarily 
restrict ourselves to the case of scalar values. 

Suppose Alice and Bob have I pairs of correlated ran- 
dom variables (X^ X[), . . . , (X t , X[), with X h X( e R, 
i = 1 . . . I , from which they intend to extract common 
bits. 

First, Alice wishes to convert each of her variables 
X into m bits and thereby defines m binary functions: 
Si (A), . . . , S m (X). To make the mapping invertible, she 
also defines a function S(X) such that mapping from X 
to the vector (S(X), Si... m (X)) is bijective. As a conven- 
tion, the range of S(X) is [0; 1]. The mapping from R to 
[0;l]x{0,l} m : 

x — ► (S(x),Si... m (x)) (7) 

is collectively denoted as S. 

Concretely, the functions Si(X) implicitly cut the real 
line into intervals (see [ljj for more details), whereas 
S(X) indicates where to find X within a given interval. 

Then, we can assemble the bits produced by the I ran- 
dom variables X\ . . . Xi into m /-bit vectors. To each bit 
vector ("slice") = (£< (*i), . . . , S^Xi)), is as- 

sociated an ECC that Alice and Bob agreed upon. To 
proceed with the correction, Alice sends the syndrome 
£k = H^Si(Xi...i) to Bob over the public authenticated 
channel, where Hf is the x I parity check matrix of the 
ECC associated to slice i. Alice also sends S{X\,.x). 

Bob would like to recover Si... m (Xi..j) from his knowl- 
edge of X[ j, £i... m and S(-X~i..j). To do so, he also con- 
verts each of his variables X[ l into m bits, but he does 
so in a consecutive manner. He tries to produce bits that 
are best correlated to Alice's and takes advantage of the 
corrected bits of slices j < i before trying to estimate 
the bits of slice i. In particular, to produce bits that are 
best correlated to Alice's first slice S\{X\.,.i), he uses a 
function Ei(X' , S(X)), which gives his best estimate on 
Alice's corresponding bit S\(X) given the known correla- 
tions between X and X' . By applying the function E\ on 



all the variables X[ l and S(X\„.i), Bob is able to con- 
struct a string of I bits that is equal to Alice's up to some 
error rate e\. Given the knowledge of £± and assuming 
the adequacy of the ECC, Bob has enough information to 
determine Si(Xi„j) with high probability. Then, for slice 
i > 1, he estimates Si(Xx„j) using the estimator func- 
tion Ei(X', S(X), Pi-x), where (3j is the random 
variable indicating Bob's knowledge of Sj(X), so that 
0j = w hh arbitrarily high probability. (Note that 
the estimators can also be written as jointly working on I 
samples at once: Ei(X[ j, S(Xi..j), (£, . . . , but we 
will preferably use the previous notation for its simplicity 
since, besides the ECC decoding, all the operations are 
done on each variable X or X' independently.) 

We also need a supplementary function to ensure 
that the process on Bob's side is described using bi- 
jective functions: E(X', S(X), 0x, . . . , (3 m ) (or jointly 
E(X' 1 _ l ,S{X 1 ,..t),(£,.._.,t;% l )). As a convention, the 
range of E is [0;1]. E is chosen so that the mapping 
£ defined below is invertible, 

s l...m) x ') ~ * (*) s l...mi El{ x i *))•••! 

E m (x', s, si... m _i), E(x', s, s' l m )). (8) 

Similarly to S, the functions Ei... m of £ cut the real 
line into intervals. However, these intervals are adapted 
as a function of the information sent by Alice, so as to es- 
timate Alice's bits more reliably. Like for S, the function 
E indicates where to find X' within an interval. 

The mapping S summarizes Alice's process of conver- 
sion of her real values X into m bits (plus a continuous 
component). The mapping £ represents the bits (and a 
continuous component) produced by Bob from his real 
values X' and his knowledge of S(X) and of the syn- 
dromes £i m . The bits produced by the functions Ei are 
not yet corrected by the ECC, even though they take as 
input the corrected values of the previous slices Sj(X), 
j < i. The description of the mapping £ with the bits 
prior to ECC correction allows us to easily express the 
bit error rate between Alice's slices and Bob's estimators 
and thereby to deduce the size of the parity matrices 
of the ECCs needed for the binary correction. Simply, 
we define e\ = Pr^-pf) ? E i (X',S(X),S 1 ... i - 1 (X))]. 
As the block size I — * oo, there exist ECCs with size 
0? — > lh(e^) and arbitrarily low probability of decoding 
error. The number of common (but not necessarily se- 
cret) bits produced by SEC is therefore asymptotically 
equal to H(Si... n {X)) - J2T=i h ( e Y) P er sample 

The generalization of the SEC to a quantum entangle- 
ment purification protocol is examined next. 

B. Quantum sliced error correction 

From classical binary error correcting codes, one can 
construct CSS quantum codes and use them to extract 
EPR pairs from noisy qubit pairs. We will now show 
that, similarly, from SEC, it is possible to construct an 
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encoding and decoding procedure, which when applied 
on entangled quantum oscillator systems, also allows to 
extract pure EPR pairs. Such a purification protocol is 
formal, as it would of course be very difficult to imple- 
ment in practice. 

The purification uses a few quantum registers, which 
we now list. Alice's system ai is split into m qubit sys- 
tems Si... m and a continuous register s. On Bob's side, 
the system b is split into m qubit systems ei... m and a 
continuous register e. He also needs m qubit registers 
s i...m f° r temporary storage. All these registers must of 
course be understood per exchanged sample: As Alice 
generates I copies of the state \^>), the legitimate parties 
use I instances of the registers listed above. 

The usual bit-flip and phase-flip operators X and Z, 
resp., can be defined as acting on a specific qubit regis- 
ter among the systems Si and e^. E.g., Z Si is defined as 
acting on Si only. These operators are used by Alice and 
Bob to construct the CSS codes that produce entangled 
qubits, which are in turn used to produce EPR pairs in 
the registers for i = 1 . . . m. Since each CSS code op- 
erates in its own register pair, the action of one does not 
interfere with the action of the other. It is thus possible 
to extract more than one EPR pair per state \^f). 
If asymptotically efficient binary codes are used, the rate 
or EPR pairs produced is R = - h(e\) - h(e?)), 

where e° (resp. ef ) indicates the bit error rate (resp. the 
phase error rate) |13| . 

The process that defines the content of the registers is 
described next. 



1. The mappings QS and Q£ 

First, we define the unitary transformation QS: 
L 2 (R) -> L 2 ([0; l])®H® m by its application on the basis 
of quadrature eigenstates: 

k) ai - v(x)\S(x))s ® \Si(x)) Sl ® • • ■ ® \S m (x)) Sm . (9) 

The states |s) g , < s < 1, form an orthogonal basis of 

L 2 ([0; 1]), a(x) — (d x S) (x) is a normalization func- 
tion, and |sj) s ., Si £ {0,1}, denotes the canonical basis 
of H, the Hilbert space of a qubit. As a convention, the 
system is called slice i. The transformation QS is de- 
picted in Fig. ^ 
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FIG. 2: Schematic description of QE and the use of the sys- 
tems Sx m 

For each slice i, Alice and Bob agree on a CSS code, 
defined by its parity matrices for bit error correction 
and Hf for phase error correction. For the entanglement 
purification, let us assume that Alice computes the syn- 
dromes of the CSS code with a quantum circuit. For 
each slice, she produces V? qubits in the state \^°) and 
If qubits in the state that she sends to Bob over a 
perfect quantum channel, so that the syndromes are re- 
ceived without any distortion. In the entanglement pu- 
rification picture, the syndromes can be transmitted over 
a non-perfect channel if they are encoded using appro- 
priate error correcting codes. Also, after reduction to a 
prepare-and-measure protocol, this perfect transmission 
is actually done over the public authenticated channel. 
Alice also sends the s system to Bob. 

Then, the slice estimators are defined as the unitary 
transformation QE from L 2 ([0;1]) ® 7i® m <8> L 2 (R) to 
£ 2 ([0; 1]) <g) H® m <g> U® m ® L 2 ([0; 1]): 

|s)s|si... m ) si J^Ob -> e ( x '^, si... m )|s)Jsi... m ) s , ^ 

®T=i\EiW, *> si..,-i)) ei \E(x', s, ai... J) s , (10) 

- ~ —1/2 _ 

where e(x',s,s[ m ) = (d x <E) {x',s,s' l m ) is a nor- 
malization function; \x') h is a quadrature eigenstate with 
x-eigenvalue x'; |ei) e ., ei S {0,1}, denotes the canonical 
basis of 7i; |e)-, < e < 1, form an orthogonal basis of 
L 2 ([0;1]). As the classical mapping £ is invertible, Q£ 
is unitary with the appropriate normalization function e. 
This mapping is defined to act on individual states, with 
the slice values s[ m as input in the system m , whose 
purpose is actually to hold Bob's sequentially corrected 
bit values 0i... m . The complete transformation jointly in- 
volving I systems would be fairly heavy to describe. Only 
the ECC correction needs to be described jointly, and as- 
suming it is correctly sized (i.e., t° are large enough), Bob 
has enough information to reconstruct Alice's bit values. 
Let us now sketch how the system m is constructed. 

Assume that Bob first calculates, using a quantum cir- 
cuit, the first slice estimator (classically: Ei(X' , S(X))), 
which does not depend on any syndrome. That is, he 
applies the following mapping, defined on the bases of 
s and b: \s)-\x') h - |s) s |£?i(x', ty^Eitf, s)) gl (up to 
normalization), where the function E\ is needed only to 
make the mapping unitary. From the I qubits in the I sys- 
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terns ei and the syndrome sent by Alice \£,i), there exists 
a quantum circuit that calculates the relative syndrome 
of Alice's and Bob's bits, that is a superposition of the 
classical quantities Q © H\ Ex{X\,„i) . From this, a quan- 
tum circuit calculates the coset leader of the syndrome, 
that is (a superposition of) the most probable difference 
vector between Alice's and Bob's qubits. An extra I — l\ 
blank qubits are needed for this operations; we assume 
they are all initialized to |0): 

l^i b (4° ©4°)> ,(. 5 )|0) ,(,-,5) - \af ffief'),,,,. (11) 
s i H 1 

Then, using a controlled-not operation between Bob's 
bits (control) and the difference vector (target), we pro- 
duce I qubits containing the same bit values as Alice's, 
with an arbitrarily large probability: 

\ e i ) e m\ s i © e i ) s 'W^\ e i ) e m\ s i ) s >m- i 12 ) 

This is how the / systems are created. 

Following this approach for the next slices, we 
can define: |s) g |si) s / \Ei(x', a)) ei \Ei(x', s)) gl -> 
\s)s\si) s , \Ei(x', s)) ei \E 2 (x', a, \E 2 (x', a, Sl )) §2 , 
and reasonably assume that the bit value given in s[ is 
equal to Alice's Si(X). This reasoning can be applied 
iteratively, so as to fill the system s[ m with all the 
corrected bit values, and with an extra step to set 
E(x', a, si... m ) in e. 

As a last step, Bob can revert the ECC decoding oper- 
ations and come back to the situation where he has blank 
qubits in s[ m as depicted in Fig. [21 

Finally, the qubits produced by Q£ can be transformed 
into EPR pairs using the CSS codes and the syndromes 
Alice sent to Bob. 



2. Phase coherence 

Neither the unitary transformation QS nor Q£ take 
into account the modulation of the coherent state in the 
p-quadrature. By ignoring what happens in the a 2 sys- 
tem of Eq. ©, the reduced system p ai b lacks phase co- 
herence: 

p 3l b = J dxdx'dpy/ Gi(x)G 1 (x')G 2 (p)\x) a± (x'\ 

D(ip)\x + iQ) b (x' + iO\D\ip). (13) 

To remedy this, we assume that Alice also sends the a 2 
system to Bob, just like she does for the s system and the 
syndromes, since the modulation in the p-quadrature is 
independent of the key. Bob can take it into account 
before applying Q£, by displacing his state along the p- 
quadrature in order to bring it on the x-axis. 

Actually, we could formally include this a2-dependcnt 
operation in the Q£ mapping, by adding \p) a to its in- 
put and output (unmodified) and by multiplying by a 



factor of the form e ix ' p ^ N ° in Eq. (JTOJl, with iV the vac- 
uum fluctuations. For notation simplicity, however, we 
mention it here without explicitly writing it. 

Also, for the simplicity of the notation in the next sec- 
tion, we can assume without loss of generality that the 
coefficients of \^f) in the x-basis of b are real, after ad- 
justment by Bob as a function of p. 



3. Construction of S and E 

Let us now make explicit the construction of the func- 
tions S and E. First assume, for simplicity, that we have 
only one slice (m = 1) — for this we do not write the slice 
index as a subscript. The mapping has thus the following 
form: 

|z> ai I A -> <r(x)\S(x)),\S(x))f{?>, S(x), S{x)) 

\E(x',S(x))) e \E(x',S(x),S(x)))- e , (14) 

where a(x) = (d x S) 1 ^ 2 (x), e(x',s,s) = 

- —1/2 _ - - 

(d X 'E) (x',s,s), and S and E range between 
and 1. 

Let us take some state p of the systems ssee. In 
the entanglement purification picture, our goal is to 
be able to extract entangled pairs in the subsystem 
p 5e = TrAu\{ s ,e} (p) ■ We thus want p to be a product 
state of the form p se ® p$e- If S(X) contains information 
about S(X), or if E(X', S(X), S(X)) contains informa- 
tion about E(X' , S(X)), the subsystem p se will not be 
pure. In the prepare-and-measure picture, information 
on S(X) in S(X) will be known to Eve and therefore 
may not be considered as secure. Note that information 
in E(. . . ) is not disclosed, but since it is excluded from 
the subsystems from which we wish to extract entangle- 
ment (or secrecy) , any correlation with e will reduce the 
number of entangled qubits (or secret bits); or stated oth- 
erwise, the calculated number of secret bits will be done 
as if E{. . . ) was public. As an extreme example, if S(X) 
and E(X' . S{X)) are perfectly correlated and if S[X) can 
be found directly as a function of S(X), then p se will be 
of the form p se = po|00)(00| +pi|ll)(ll|, which does not 
allow us to extract any EPR pairs, or equivalently, does 
not contain any secret information. Consequently, S and 
E should be as statistically independent as possible of S 
and E. 

We define S and E as the following cumulative prob- 
ability functions: S(x) =_Pr[X < x \ S(X) = S(x)] and 
E(x', a, s) = PrpT < x'\S(X) = a, S(X) = s, E(X', s) = 
E(x',s)]. By definition, these functions are uniformly 
distributed between and 1, independently of the other 
variables available to the party calculating it (Alice for S 
and Bob for E). These functions also enjoy the property 
of making the subsystem p se pure in absence of eavesdrop- 
ping (i.e., when p is pure), indicating that this choice of 
S and E does not introduce more impurity in p se than p 
already has. 
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For a pure state = J dxdx'f(x, x')\x) \x') b , with 
|x) a (resp. \x') b ) an x-eigenstate in ai (resp. in b), the 
application of QS and Q£ gives: 




where x and x' are shorthand notations for x(s, s) and 
x'(e, e, s) respectively. Let f± and f% be real and non- 
negative functions verifying f(x,x') = /i(x)/2(x, x'). 
fi (x) is chosen such that | /i (x) \ 2 is the probability den- 
sity function of Alice's modulation, and /2(x,x') such 
that 1/2(2;, x') 1 2 is the probability density function of 
Bob's measured value x' conditionally to Alice send- 
ing x. Then, it is easy to check that we can factor 
Y, a ,be{OA} a ab\ab) se out of \ip) by setting: 

a(x(s,s)) =a (s)(fi(x(s,s)))~ , (16) 

e(s, x'(e, e, s),s) =e (e, s)(/ 2 (x(s, s), x'(e, e, s)))~ , 

(17) 

where 

a 2 (s) = f |A(x)| 2 dx, (18) 

J x:S(x)—s 

e 2 (e,s) = f |/ 2 (x, x%dxdx'. (19) 

J x,x':S(x)=s,E(x',S(x))=e 

The conclusion follows from the definition of a and e. 

When more than one slice is involved, the functions 5* 
and E arc defined similarly: 

S(x) = Pr[X < x\Si... m {X) = Si... m (x)], (20) 
E(x', s, si... m ) = Pr[X' < x'\S(X) = s 
A Si... m (X) = si... m 
A-Ei(X',s) = £i(x',s) A... ^ ' 
A E m (X', s, si... m _i) = E m (x', 5, Si... TO _i)]. 

V. THE ATTENUATION CHANNEL 

We now apply the slicing construction and display 
some results on the rates one can achieve in an important 
practical case. These results serve as an example and do 
not imply an upper bound on the achievable rates or dis- 
tances. Instead, they can be viewed as lower bounds on 
an achievable secure rate in the particular case of an at- 
tenuation channel with given losses. Stated otherwise, 
this section simulates the rates we would obtain in a real 
experiment where Alice and Bob would be connected by 
an attenuation channel. For more general properties of 
the construction, please refer to Sec. IVII 

The purpose of this section is twofold. First, we wish to 
illustrate the idea of the previous section and show that it 
serves realistic practical purposes. Beyond the generality 
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FIG. 3: Error and EPR rates with two slices in an attenuation 
channel 



of the sliced error correction, its implementation may be 
easier than it first appears. Furthermore, the purification 
(resp. distillation) of more than one qubit (resp. bit) per 
sample is useful, as illustrated below. 

Second, it is important to show that the construction 
works in a case as important as the attenuation channel. 
Clearly, requesting that a QKD protocol yields a non-zero 
secret key rate under all circumstances is unrealisitic — 
an eavesdropper can always block the entire communi- 
cation. On the other hand, a QKD protocol that would 
always tell Alice and Bob that zero secure bits are avail- 
able would be perfectly secure but obviously also com- 
pletely useless. Of course, between these two extreme 
situations, the practical efficiency of a QKD protocol is 
thus important to consider. 

The attenuation channel can be modeled as if Eve in- 
stalled a beam-splitter in between two sections of a loss- 
less line, sending vacuum at the second input. We here 
assume that Alice sends coherent states with a modula- 
tion variance of 31A^ , with N the vacuum fluctuations, 
which gives Alice and Bob up to I(A; B) = 2.5 common 
bits in absence of losses or noise. This matches the order 
of magnitude implemented in 0. We define the slices 
Si and S2 by dividing the real axis into four equiprob- 
able intervals labeled by two bits, with Si representing 
the least significant bit and S2 the most significant one. 
More precisely, Si (x) = when x < — r or < x < t and 
5i(x) = 1 otherwise, with t = V2 x 317V err 1 (l/2), 
and S*2(x) = when x < and ^(x) — 1 otherwise. 

In this constructed example, we wish to calculate the 
theoretical secret key rate we would obtain in an identical 
setting. For various loss values, the secret key rates are 
evaluated by numerically calculating Tr((Z Si ® Z ei )p), to 
obtain the bit error rates of slices i = 1, 2 and Tr((X Si (g) 
X^)/?) to obtain the phase error rates. Then, assuming 
asymptotically efficient binary codes, the rate is R = 
Ri+R2=J2 i = 1 , 2 (l--h(e*)-h(e»)), 

Using this two-slice construction, we were able to get 
the EPR rates described in Fig. For the case with no 
losses, it is thus possible to distill R = 0.752 + 0.938 = 
1.69 EPR pairs per sample. Also, note that the phase er- 
ror rate increases faster with the attenuation for p 2 than 
for px, with p l = p 5iSz = Tr A1 i\ {si)e . y(p). This intuitively 
follows from the fact that the information Eve can gain 
from her output of the beam splitter affects first the most 
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significant bit contained in S^X). 

Due to the higher bit error rate in pi, it was not pos- 
sible to distill EPR pairs in slice 1 with losses beyond 
0.7 dB. It was however still possible to distill EPR pairs 
in slice 2, up to 1.4 dB losses (about 10km with fiber 
optics with losses of 0.15dB/km). This result does not 
pose any fundamental limit, as it can vary with the mod- 
ulation variance and with the choice of the functions Si 
and 5*2 . Note that the slice functions could be optimized 
in various ways, one of which being to use other intervals 
(as done in |l7j , not necessary equiprobable and possibly 
chosen as a function of the losses), and another being to 
consider multi-dimensional slices as explained in the next 
section. 

Finally, note that although this example involves a 
Gaussian channel, this particularity is not exploited here 
and such a calculation can be as easily done for a non- 
Gaussian attack. 



VI. ASYMPTOTIC BEHAVIOR 

In this section, we study the behavior of the slice con- 
struction when the slice and slice estimator mappings 
take as input a block of w states, with w arbitrarily large. 
In i the classical sliced error correction is shown to re- 
duce to Slepian-Wolf coding [23] (asymmetric case with 
side-information) when using asymptotically large block 
sizes. We here study the quantum case, which is different 
at least by the fact that privacy amplification is explicitly 
taken into account. 

For simplicity of the notation, we will study the asymp- 
totic behavior in the case of an individually-probed chan- 
nel only (although Eve's measurement can be collective). 
A study of periodic probing with period much smaller 
than the key size would give the same results, since in 
both cases it allows us to consider a sequence of identical 
random experiments and to study the typical case. How- 
ever, joint attacks, with width as large as the key size, 
are outside the scope of this section, as the statistical 
tools presented here would not be suitable. 

It is important to stress out that we here investigate 
what the secret key rates would be if the actual channel 
is an individually-probed one. The use of the protocol of 
this paper still requires to evaluate the phase error rate 
in all cases and this quantity is sufficient to determine the 
number of secret key bits. In the case of joint attacks, the 
secret key rates stated in the special cases below would 
then differ from the one obtained using the phase error 
rate. 



A. Direct reconciliation 

We thus here consider a block of w states and the func- 
tions S, S, E and E on blocks of w variables as well. 
Among the qubits produced by QS, there is a certain 
number of them whose disclosed value allows Alice and 



Bob to correct (almost) all bit errors for the remaining 
slices. Then, among the remaining slices, a certain num- 
ber of qubits allows Alice and Bob to correct (almost) all 
phase errors for the rest of the qubits. These last qubits 
are thus equivalent to secret key bits in the prepare-and- 
measure protocol. 

We consider the following state, with the action of 
the channel modeled as joining system b with that of an 
eavesdropper Eve, and with p left out as a public classical 
parameter: 

|*(p)) - J dxg{x)\x) ai \4>{x,p)) biWt . (22) 

We consider w such states coherently, and the mappings 
QS and Q£ take all w states as input. We will fol- 
low the lines of the reasoning in [2(J, |2j 0] to show 
that the secret key rate tends to I(X; X 1 ) — I(X; E) for 
w — > oo, with X the random variable representing Alice's 
measure of ai with x, X' the measure of b with x, and 
I(X-E) = H(X) + H( Peve ) - ff(p ai ,eve), where H{p) is 
the Von Neumann entropy of a state p. The remainder 
of the discussion must be understood for any e, eu > 0, 
with w sufficiently large. 

Consider a mapping U from R to a finite set U 
of size 2 m , for some sufficiently large m, such that 
I(U(X);X') > I(X;X') - e v . Let S{X) be the remain- 
ing continuous information not contained in U(X), de- 
fined as in Sec. IIV B 31 Let x(s, u) be the mapping that 
recovers x from S(x) and U(x). 

We here recall some definitions from [2^. For a given 
value of and (s (w \p^ € R w ), a HSW code 
pol l24j B is a subset of U w such that the corresponding 

w-wide states \4 w) ( x(w) { s{w \ u{w) ),P (w) ) b w eve' ui ' w) e 
B, can be distinguished by Bob with probability at least 
1 — e. A privacy amplification (PA) set £ is a subset 
of U w such that the sum of the corresponding states 

E„W ef l^ ) (a= (u ' ) (s (w U (u ' ) ),P (u ' ) )) b (») eV e factors Eve. 
Finally, a key generation code B is a HSW code that 
can be divided into a collection of non-overlapping PA 
sets B — UkSk- In the sequel, we drop the w superscript 
for simplicity. 

Consider three consecutive ranges / = 1 . .. \I\, J = 
\I\ + 1 . . . |/| + 1 J|, K =\I\ + \J\ + l... \I\ + \J\ + \K\ with 
sizes |/| = \wH{U{X)\X') + e|, \J\ = \wI{U{X)\E)~\ 
and \K\ = \wI{U{X);X') - wI{U{X);E) - e). Note 
that |/| + I J| + \K\ < wH{U{X)) + 2 < wm + 2. These 
three ranges will correspond to three kind of slices in the 
derived prepare- and- measure protocol: Si, Sj and Sk ■ 
Si will give Bob enough information to perform error 
correction, Sj will contain bits, equal between Alice and 
Bob, which will be sacrificed with PA since they are not 
necessarily secret, and 5*^ will contain equal and secret 
bits (i.e., key bits). 

From [23, it is possible to cover the space of wm + 
2-bit vectors with 2' 7 ' key generation codes C SI of size 
2 1 J I +1^1, To each element ofU w , we assign a |/|-bit vector 
that identifies the key generation code it belongs to; this 
defines the first |/| slices Si(X). 
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By providing the bit syndromes £j? to Bob, he can 
identify Si(X) — Si and the associated key genera- 
tion code C Sl . By definition, he has enough infor- 
mation to identify an element within it. Such an 
element can be uniquely labeled by a \J\ + |i^|-bit 
vector, thereby defining Sj and Sk- So, there ex- 
ists a mapping that maps |sj) s / \<f>{x{s, u),p)) b eve onto 
\si) sli \s JK ) ejK \(l)'(x(s,u),p)) iei eve with probability at 

least 1 — e, and thus e° < e, Wi € J U K. 

Each key generation code contains 2> K > PA sets of size 
2' J I each [23]. The labeling can be such that Sk cor- 
responds to the identification of the PA set and Sj the 
element inside the PA set. 

Providing the phase syndromes £j to Bob gives him 
enough information to determine the phase of Alice's 
qubits in Sj. If the phase errors are corrected by Bob, 
measuring or tracing out subsystems sjej is equivalent 
to summing the slices in J over all possible bit values and 
thus factoring out Eve. More precisely, with s, si and p 
fixed (and the corresponding subsystems not shown), and 

with \sp s , = 2- 1 / 2 (|0) S; +(-1) Sj *|1) Sj ) (and similarly for 

ej and s'.), the system after correction of si is of the form: 

|*>= E \sj K } SjK \0} 5[j \sjK} ejK W(sjK))- e , ei , eve 
sksj 

= E (- 1 ) Sj(S * /+erj) |^)sjl^)s K 

®|0> s />}) e .|**>e*l*W)>S I e I> e«- ( 23 ) 

Then Alice sends to Bob information about her phase 
(sj), which he stores in his auxiliary register s' 7 . The 
state becomes: 



Given the size of if, we conclude that the secret 
bit rate can asymptotically come as close as desired to 
I(X;X') — I(X;E). Note that in the particular case of 
the attenuation channel, an evaluation of the secret key 
rate can be found in [2, [H| • 



B. Reverse reconciliation 

So far, we have always assumed that the slices apply 
to Alice and the slice estimators to Bob. However, there 
are some cases for which the opposite case increases the 
secret bit rate 0. 

Let us start again from the state \^(p)) as in 
and rewrite \(/>(x,p)) b&/e as \<f>(x,p)) b eve = 
jdx' f(x,p,x')\x') b \cf)(x,p,x')) eve . Let h(x',p) be 
a non- negative real function such that h 2 {x',p) — 
fdx\g(x,p)f(x,p,x')\ . Then, 



|¥(p)) = Jdx' h{x',p)^\W^,P)) 3l ^ 

With |</>V,P)) ai .eve = 

dx g(x,p)f(x,p, x')/h(x',p)\x) ai \<f>(x,p, x')) eve . (26) 



Thus, by applying the same argument as for direct recon- 
ciliation, we can asymptotically reach I(X; X')—I(X'; E) 
secret bits when QS is applied on system b and Q£ on 
system ai. The evaluation of the secret ke y ra te for re- 
verse reconciliation can also be found in 



VII. CONCLUSION 



Key rai 

ilia. 



s .j)s*\ s K) SK 
<j)s'\^e'>K) eK W(sj K ))- eeiteve . (24) 



The difference between Alice's and Bob's phases is calcu- 
lated in s'j and the correction is applied to e}. Overall, 
this transformation can be summarized as \sj) 1 |ej) e , — > 

\ s j + e j) 5 ' l s j) e * • ^ ms gi yes tne following state: 



E 



® E (^r jK+C;) |^^)^'fe)), ei! e,e 
sj,(s;+ej) 

= E l S J>s* / l S ^)s A J S })e* / l^>e K 
sks'j 

®El^)s:;l^'( S ^))^,eve- (25) 

sj 

Finally, the sum J2 SJ \ s j) s $\4>'{sjK))e, eit0/e factors out 
Eve, by definition of a PA set. 



In this paper, we studied the equivalence between an 
EP protocol and a QKD protocol with sliced error cor- 
rection for reconciliation. In the QKD protocol, Alice 
sends Gaussian-modulated coherent states to Bob, who 
measures the result using homodyne detection. To probe 
the channel and determine the amount of entanglement 
that can be transmitted through it, Bob has to make 
homodyne measurements in all quadratures. 

We found that the EP protocol based on sliced er- 
ror correction is indeed efficient and allows its equivalent 
prepare-and-measure QKD protocol to produce a secret 
key which is secure against any eavesdropping strategy. 
Although the qubit encoding scheme is derived from a 
reconciliation protocol easily implementable in practice 
[3, the main drawback of the method is the possibly 
huge number of measurements to get a statistically rel- 
evant estimation of the phase error rate and thus the 
number of secret key bits. Yet in theory, the sample set 
can be reduced to an arbitrarily small fraction of the pro- 
duced key, when an arbitrarily large number of quantum 
states are processed through secret key distillation. 

An advantage of this method is that it can in principle 
be adapted to other modulation distributions — the fact 
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that the modulation is Gaussian is not crucial. In prac- 
tice, the finite range of the amplitude modulator does 
not allow one to produce a real Gaussian distribution for 
the prepare-and-measure protocol, and one can take this 
effect explicitly into account. Also, it may be more effi- 
cient to consider a modulation of coherent states along a 
uniform distribution over a finite domain of (x,p) (e.g., 
a square or a circle centered on (0,0)) so as to increase 
the correlations between Alice and Bob. 

Open problems for further research include the im- 
provement of the statistical estimation of the EP param- 
eters, the investigation of other modulation distributions 
and the optimization of the encoding scheme for practical 
implementations . 
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